Tag Archives: ldap

Using Nmap for pentesting eDirectory

While doing a security review the other day I came across Novell eDirectory running on Windows. It’s been a while since I looked at eDirectory and while it’s a lot of LDAP, the servers were also running the Netware Core Protocol (NCP). I noticed that there wasn’t any NCP support in Nmap so I decided that I would implement some basic support. I ended up writing a NCP library and the following two scripts:

  • ncp-enum-users – enumerates eDirectory users
  • ncp-serverinfo – lists some basic server information

The scripts should work against NCP running on both Netware, Linux and Windows. Here’s some sample output from both scripts:

In addition to the NCP scripts I wrote a LDAP script (ldap-novell-getpass) that extract the plain-text password of a given user, in case the “Allow admin to retrieve passwords” option is enabled in the password policy. On success, the script returns the following result:

All of the scripts have been committed to Nmap and are available through subversion.

LDAP for Nmap

Just posted some code (libraries and scripts) that allows Nmap to do LDAP queries. It’s available from the nmap-scripts page. The code consists of two libraries asn1 and ldap that do most of the work. The LDAP library supports the SearchRequest, BindRequest and UnbindRequest operations and therefore supports both unauthenticated and authenticated searches.

The functionality is still somewhat limited and the library has the following shortcomings in my opinion:

  • At the moment it only supports simple bind
  • It lacks filter parsing support. That said, it supports filters, but they need to be supplied using tables rather than their textual representation as described in RFC 2254.
  • SSL is currently not supported mainly because I didn’t have an SSL enabled LDAP server running.
  • Some attributes returned by AD fail parsing and return a blob of hex characters.
  • There’s an annoying GUI indentation bug that needs tending to.

Despite these shortcomings I’m releasing a first version of the library and scripts. The scripts have undergone limited testing against both OpenLDAP and ActiveDirectory.